tinba | 096fcf18cc3c87f74943ae740622b489bb1c575ced7ca13cff97b50fe79b3da2 | Triage

Sharing

General

Target

096fcf18cc3c87f74943ae740622b489bb1c575ced7ca13cff97b50fe79b3da2
Size

225KB
Sample

241020-w3rkxsshrg
MD5

1a19f01e683f8fa063a69df48196b0df
SHA1

4efebd7dc4734443981c62f5c44375d4d7a88f3c
SHA256

096fcf18cc3c87f74943ae740622b489bb1c575ced7ca13cff97b50fe79b3da2
SHA512

9fd12c04d230a1a8137162ba6a695273f55a7501a8f87f291a69ab3e8a6f9da67a404f70bcc494c8ac6a2ac6bf84cc266d7f5a3d2d35bd5b5f26a04bf0d38114
SSDEEP

6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgf

Score

10^/10

tinba banker discovery persistence trojan

Malware Config

Targets

- Target
  
  096fcf18cc3c87f74943ae740622b489bb1c575ced7ca13cff97b50fe79b3da2
- Size
  
  225KB
- MD5
  
  1a19f01e683f8fa063a69df48196b0df
- SHA1
  
  4efebd7dc4734443981c62f5c44375d4d7a88f3c
- SHA256
  
  096fcf18cc3c87f74943ae740622b489bb1c575ced7ca13cff97b50fe79b3da2
- SHA512
  
  9fd12c04d230a1a8137162ba6a695273f55a7501a8f87f291a69ab3e8a6f9da67a404f70bcc494c8ac6a2ac6bf84cc266d7f5a3d2d35bd5b5f26a04bf0d38114
- SSDEEP
  
  6144:JA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:JATuTAnKGwUAW3ycQqgf
Score

10^/10

tinba banker discovery persistence trojan
- Tinba / TinyBanker
  Banking trojan which uses packet sniffing to steal data.
  trojan banker tinba
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tinbabankerdiscoverypersistencetrojan

behavioral2